Few days ago, we were launching our first Express.js App. If you are not familiar with this framework, you can find previous post with hands-on video HERE

Today I want to briefly talk security as in today's digital age, the security of web applications and APIs is more important than ever. As developers, we need to be proactive in protecting our applications from various security threats. One effective way to enhance the security of your Express.js applications is by using the npm package, Helmet.

What is Helmet?

Helmet is a middleware package for Express.js that helps secure your applications by setting various HTTP headers. These headers can prevent a range of common web vulnerabilities, making it easier to protect your application from attacks.

How can it help?

Helmet provides several security features through its various middleware functions:

• Content Security Policy (CSP) - Helps prevent cross-site scripting (XSS) attacks and other cross-site injections.
• Cross Origin Resource Policy (CORS) - Blocks others from loading your resources cross-origin.
• DNS Prefetch Control - Controls browser DNS prefetching to improve privacy and security.
• Frameguard - Protects your application from clickjacking attacks by setting the X-Frame-Options header.
• Hides Powered-By - Removes the X-Powered-By header to make it harder for attackers to see what technologies you are using.
• HSTS (HTTP Strict Transport Security) - Enforces secure (HTTP over SSL/TLS) connections to your server.
• IE No Open - Sets X-Download-Options for Internet Explorer to prevent downloads from being opened automatically.
• NoSniff - Prevents browsers from MIME-sniffing a response away from the declared content-type.
• XSS Filter - Sets X-XSS-Protection to prevent reflected XSS attacks.

How to start?

To get started with Helmet, you need to have an existing Express.js application. If you don't have one, you can create a basic Express.js server following the steps in our previous post.

Install Helmet

npm install helmet

Use Helmet in your Express.js app

const express = require('express');
const app = express();
const PORT = 8000;
const helmet = require('helmet');

app.use(helmet()); // Use Helmet to secure your Express app

app.get('/', (req, res) => {
  res.send('Hello!');
});

app.listen(port, () => {
  console.log(`Server is listening on port: ${port}`);
});

And that's basically it. By adding app.use(helmet()), you automatically include all of Helmet’s default security protections.

• Let's meet tomorrow and learn something new!